User:Louis/3D printer firearm-blocking mandates and geometric false positives

A 3D-printing file is a description of geometry, nothing more. An STL mesh is a list of vertices and the triangles drawn between them; a computer-aided-design file is a set of solids and the operations that build them; G-code is a sequence of coordinates the print head moves through. A program reading any of these sees coordinates, volumes, bores, threads, wall thicknesses, and tolerances, and nothing that records what the object is for. It has no concept of a gun, so it cannot tell a restricted firearm part from a benign object that shares its shape. New York's 3D printer blocking technology mandate orders printers to run that scan anyway: a printer sold in the state would refuse a print job until a firearms blueprint detection algorithm has evaluated the file and found it will not produce a firearm or illegal firearm part. The statute defines that algorithm as software that reads a printing file "whether in the form of stereolithography (STL) files or other computer aided design files or geometric code," and directs the state to supply it with a library of blueprint files "including scans of seized firearms."

That leaves two outcomes, both bad. To the scanner a firearm part is a signature: a combination of primitive shapes and dimensions, shared by any benign object built to the same proportions. Set the filter wide enough to catch the gun part and it flags pipes, brackets, flashlight bodies, and electronics enclosures. Narrow it to spare them and a builder defeats it with an edit smaller than the eye can see, or by splitting the part into pieces that each resemble nothing in particular. Either the false-positive rate is high enough to flag everyday hardware, or the false-negative rate is high enough to make the mandate a formality. The Electronic Frontier Foundation called the requirement "an unfeasible tech solution." Phillip Torrone of the open-source hardware company Adafruit, whose analysis Techdirt reproduced, framed it as a classification problem carrying high false-positive and false-negative rates. The mandate also aims at the wrong object: it regulates the printer, which makes only the low-stress frame, while the barrel, slide, and bolt that contain a fired cartridge are bought as unregulated metal parts. It is enacted but not yet in force.

The companion essay develops that chokepoint argument in full. What follows is the geometric half: section by section, the shapes the statute would have a scanner flag, and the everyday objects no scanner can reliably tell them apart from.

How a geometry scanner reads a print file

There are three plausible ways to build the detection the statute describes, matching the three file forms it names. Each fails in a different way.

Pre-slice file hashing and mesh feature matching

The simplest filter computes a digital fingerprint of an STL or 3MF file and compares it against a list of known firearm files, or matches mesh features against a stored template. An STL file is only a list of coordinates for the triangles that tile an object's surface. Moving a single vertex by a thousandth of a millimeter, or remeshing the surface so it carries one fewer triangle, rewrites the file and changes its fingerprint while leaving the printed object identical to the hand and to a set of calipers. A library of fingerprints, the form the statute's directive to store "scans of seized firearms" most often takes, matches only the files it has already recorded, byte for byte. Feature matching against a template is harder to evade than a raw fingerprint, but it reduces to measuring a shape against a reference, which returns to the central problem: the reference shapes are shared with benign parts.

Post-slice G-code and layer analysis

Because file fingerprinting is brittle, a scanner could instead read the G-code the slicer produces. G-code is not a model; it is a list of motor moves, the tool path the print head follows layer by layer. The same receiver yields different G-code when it is rotated on the build plate, sliced at a different layer height, or filled with a different infill pattern. Recovering the three-dimensional object from the tool path means simulating the whole print. The file a printer executes describes paths, not labeled parts. Torrone added that the bill could be improved by exempting open-source firmware, and many printers run offline or on firmware no state library reaches. A part printed face-down in an unusual orientation presents the scanner with an unfamiliar tool path.

Machine-learning voxel and point-cloud classifiers

The most capable approach trains a model on the volumetric shape, the voxels, or on the surface points of an object. A trained classifier does not know what a firearm is; it has learned that certain clusters of coordinates correlate with the examples labeled as guns. A benign part with the same shape satisfies the same correlation. Push the decision boundary wide enough to catch a lightly edited firearm component and it sweeps in the brackets and tubes that sit near it in shape space; pull it in to spare them and a small edit moves the firearm part across the line. Torrone described exactly this trade between false positives and false negatives.

The pairs below are the concrete form of that trade. Each is a restricted firearm component beside a benign object that occupies the same region of shape space. Where a freely licensed image of both objects exists, they are shown side by side.

Restricted components and their benign geometric twins

Suppressor baffle and Tesla valve

• 
  Figures 1A and 1B of a firearm sound suppressor baffle: a conical bell with a central aperture and a rear plate. US Patent 7,987,944, public domain.
• 
  Nikola Tesla's Valvular Conduit, patented February 3, 1920: a one-way fluid conduit that uses internal cones and baffles to resist reverse flow. US Patent 1,329,559, public domain.

A sound suppressor slows the gas leaving a muzzle by passing it through a stack of internal baffles. The K-baffle, named for the shape its cone and spacer trace in cross-section, is drawn in US Patent 7,987,944 for a firearm sound suppressor baffle as a conical bell with a central aperture set in a rear plate. Its job is to make a gas stream turn and collide with itself.

Making a fluid turn and collide with itself, with no moving parts, is the entire function of a valvular conduit, the one-way passage Nikola Tesla patented in 1920 as US Patent 1,329,559. Tesla's drawings show a run of internal cones and buckets that let fluid pass easily one way and resist it the other. A single segment of that conduit and a suppressor baffle are the same primitives: an outer cylinder, an internal conical frustum, a central bore, and ports for cross-flow. A scanner that flags a hollow cylinder holding internal cones around a central aperture flags both the silencer baffle and the fluid valve.

The edit that defeats it is a thin solid membrane sealing the central aperture in the file. To the classifier the part is then a closed cup, not a baffle with a bore. After printing, the membrane is pushed out with a screwdriver.

Pistol conversion device and camera accessory shoe

• 
  Glock-pattern pistols fitted with a rear backplate auto-sear conversion device, commonly called a Glock switch. Source Wikimedia Commons, public domain (ATF).
• 
  A camera flash and accessory shoe: the rectangular dovetail-rail mount with center contacts. Source Wikimedia Commons (Alex.K.NY, CC BY-SA 3.0).

A pistol conversion device, commonly called a Glock switch, replaces the rear backplate of a Glock-pattern pistol and holds the trigger bar so the pistol fires automatically. Title 26 of the U.S. Code defines a machinegun at 26 U.S.C. § 5845(b) to include:

any part designed and intended solely and exclusively, or combination of parts designed and intended, for use in converting a weapon into a machinegun.

Geometrically the device is a small rectangular block with a dovetail rail on one face, which slides into the rear channel of the slide, and a central pin or cam.

A camera accessory shoe, the mount that holds a flash on top of a camera, is a small rectangular block with a dovetail rail and a center contact. To a bounding-box or point-cloud classifier, a dovetailed block a centimeter or two on a side is a dovetailed block a centimeter or two on a side. The defeat is a slight rescale, inside the shrinkage tolerance of fused-deposition printing, or a superficial fin added to the outside face that changes the bounding volume without touching the rail that does the work.

Suppressor outer tube and flashlight body

• 
  Sound suppressors, the cylindrical tubes at left, mounted on several firearms. The outer body of a suppressor is a hollow threaded cylinder. Source Wikimedia Commons (Cortland, public domain).
• 
  An aluminum flashlight with a knurled, threaded tubular body and a threaded bezel and tailcap. Source Wikimedia Commons (redjar, CC BY-SA 2.0).

The outer body of a suppressor is a hollow cylinder, threaded at one end to mount on a barrel and often at the other for an end cap, enclosing the baffle stack. A heavy aluminum flashlight body is a hollow cylinder, threaded at one end for the head and at the other for the tail cap, enclosing a stack of batteries. Both are two concentric cylinders with helical threads cut at the ends. A telescoping camera pole, a vacuum wand, and a plumbing adapter are the same. A scanner that flags threaded tubes of suppressor diameter flags the flashlight, the pole, and the adapter. The defeat is to split the tube into two shorter unthreaded cylinders joined by a slip fit, so no single file is a threaded tube of the flagged length.

AR-15 lower receiver and electronics enclosure

• 
  A stripped AR-15 lower receiver: the magazine well, fire-control pocket, threaded buffer-tube boss, and pin holes. Wikimedia Commons (Thewellman, CC0).
• 
  A 3D-printed Raspberry Pi enclosure: a rectangular polymer housing with cutouts for ports and a single-board computer. Wikimedia Commons (Gary C Martin, CC BY 2.0).

Federal law regulates the frame or receiver as the firearm: 18 U.S.C. § 921(a)(3) includes "(B) the frame or receiver of any such weapon," and in Bondi v. VanDerStok the Supreme Court restated that a frame or receiver "is, even when sold separately, subject to the Act's requirements." On the AR-15 the lower bears little of the firing stress. The Small Arms Survey described its role this way:

is primarily intended to ensure the correct alignment and interface of the operating parts of the firearm, and to house the trigger and fire selector and safety mechanisms.

Geometrically it is a polymer chassis with a rectangular magazine-well void, a smaller rectangular fire-control void, a threaded cylindrical boss at the rear, and a few through-holes for pins.

A 3D-printed enclosure for a single-board computer is a polymer chassis with a rectangular void for the board, a slot for ribbon cables or a battery, a threaded boss for mounting, and through-holes for screws. The shared primitives are hollow orthogonal boxes and a threaded cylinder. The defeat here is the split-file method described below: a receiver cut down its centerline into two halves, each an open shell that matches no whole-receiver signature, printed separately and bonded.

Pistol grip and power-tool handle

• 
  A Magpul MIAD pistol grip on an AR-15 lower receiver: an ergonomic, textured polymer handle. Source Wikimedia Commons (NobuttoO, CC0).
• 
  A cordless drill with a pistol-grip handle and a hollow core for the battery and motor. Source Wikimedia Commons (Fructibus, CC0).

An AR-15 pistol grip is an ergonomic handle: an elliptical sweep with finger contours, a hollow core, and a tang that bolts to the receiver. A replacement drill handle, an air-hammer grip, and a bicycle grip are the same elliptical sweep with finger contours and a hollow core. A model trained on overall hand-grip shape indexes on the morphology shared by every tool made to be held in a fist. The defeat is cosmetic: a heavy surface texture, a Voronoi pattern common in printed parts, or a rescale changes every vertex and defeats a fingerprint or a shape match while the mounting interface stays intact.

Glock frame and barcode-scanner handle

• 
  A Glock 17 pistol. The polymer frame carries the grip, trigger guard, and dust cover; it sets the grip angle, the trigger guard loop, and a hollow core. Source Wikimedia Commons (Asklid Antonsen, CC BY 2.0).
• 
  A Honeywell handheld barcode scanner with a pistol-grip handle and a trigger inside a guard loop. Source Wikimedia Commons (Raimond Spekking, CC BY-SA 4.0).

The polymer frame of a Glock pistol sets the grip angle, the trigger guard loop, and a hollow core. A handheld barcode scanner has a grip set at a similar angle, a trigger inside a guard loop, and a hollow core for its electronics. This is the weakest pair of the set: a well-tuned classifier given enough resolution could separate the two on the detail of the slide rails, where the geometries differ. It is offered as the boundary case, the point at which the shapes begin to diverge, not as an equivalence. A classifier light enough to run on a consumer printer's controller, or one fed a low-resolution voxelization to save computation, gives up the fine detail that tells the two apart.

Additional geometric twins

Four further pairs make the same point but lack a freely licensed image to show both objects side by side.

The AR-15 lightning link and a flat slotted bracket. A lightning link is close to a two-dimensional part: a thin flat plate with a central rectangular slot and a small bent hook. A cabinet-latch plate, a leaf spring, and a slotted shim are flat plates with a slot and a tab. A builder can print the part slightly thicker than the working thickness and sand it down after printing, or print a solid blank scored with a break-away outline that hides the slot from the scanner.

The drop-in auto sear and a small pivot block. A drop-in auto sear body is a small rectangular block with a U-shaped channel and a transverse pin hole. Section 5845(b)'s definition of a machinegun reaches any "combination of parts designed and intended ... for use in converting a weapon into a machinegun." A hinge base, a window-track stop, and a robotics pivot bracket are small blocks with a channel and a cross-hole. The builder prints a plain block and cuts the channel and the hole afterward with a hand drill and a rotary tool.

An SKS or AK conversion sear pairs with an angle bracket. This sear is a small bent strip of metal or polymer with one pivot hole, geometrically an L-bracket or a cantilever clip. The builder prints it flat, as a straight strip, then bends it to the working angle with heat after printing; the scanner sees a flat ruler.

The rifle magazine body and a parts hopper. A standard box-magazine body is a thin-walled curved box with internal guide ribs and feed lips at the top. A curved parts hopper or gravity dispenser is a thin-walled curved box with ribs. The feed lips are the one feature unique to the magazine, so a builder prints the body as a plain curved box and prints the feed lips as a separate small part to attach later.

The block runs on software the vendor does not own

The statute orders the printer to run the scan, but the printer does not run on the vendor's own code. The slicer that turns a model into tool paths and the firmware that drives the motors are open-source projects the major manufacturers forked rather than wrote, and the license on that code decides what a vendor is allowed to ship.

The slicers are one family tree under one license. Slic3r, the common ancestor, is released under the GNU Affero General Public License version 3 (AGPLv3). PrusaSlicer is a fork of Slic3r and keeps that license; Bambu Lab's Bambu Studio is a fork of PrusaSlicer; OrcaSlicer is a fork of Bambu Studio and PrusaSlicer; Creality Print is a fork of OrcaSlicer. Every one is AGPLv3. CuraEngine, the slicing back-end of Ultimaker's Cura, is AGPLv3 as well. The firmware is the same story under the GNU General Public License version 3 (GPLv3): Marlin, which runs most fused-deposition printers, Klipper, and Duet3D's RepRapFirmware are all GPLv3. Prusa ships an AGPLv3 slicer, Bambu ships an AGPLv3 slicer, Creality ships an AGPLv3 slicer, and the firmware moving the print head on those machines is GPLv3. A maker like Creality or Bambu Lab did not write Marlin or Slic3r and does not hold the copyright; it took the code as a downstream user, so it is bound by the upstream license.

What the license requires is specific. GPLv3 and AGPLv3 define the Corresponding Source a distributor must hand over:

all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work.

Ship a modified binary and you ship the source that produced it. For hardware the obligation goes further. GPLv3 Section 6 defines the Installation Information a vendor must provide with a "User Product":

any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.

The same section defines a User Product to include a consumer product:

a "consumer product", which means any tangible personal property which is normally used for personal, family, or household purposes.

That is the bind. A vendor has two ways to put the state's filter on a machine, and copyleft constrains both. Bake the filter into the AGPLv3 slicer or the GPLv3 firmware, and the corresponding-source obligation requires the vendor to ship the source for the conveyed binary, including the code that does the blocking and where in the geometry check it sits, so an owner can cut those lines and recompile; the Installation Information clause requires the keys and procedures needed to install and run that modified build on the machine. Or leave the open-source stack and write a closed slicer and firmware from scratch. Describing the work behind PrusaSlicer 2.0, Prusa Research said it spent "roughly 21,440 man hours on the program, made 5769 commits and 61 releases," and that covered one rewrite, moving the existing program from Perl to C++. Matching a tool with a decade of development behind it means rebuilding mesh repair, tool-path planning, infill, supports, and G-code generation from nothing, on a hardware maker's margins, which is why every major vendor forked the existing code instead of writing its own.

The escape is narrower than impossible. A vendor could run the filter in a separate closed program that screens a file before the open-source slicer sees it, or on a from-scratch cloud service where no binary is handed to the user at all. AGPLv3 reaches the cloud route only when the cloud slicer reuses AGPL code: Section 13 says a modified version offered over a network to "all users interacting with it remotely through a computer network" must be accompanied by an offer of the corresponding source. Those are the costly paths. The cheap one the mandate quietly assumes, patching the slicer every vendor already ships, is the one these obligations reach.

This is not a hypothetical reading. The source-disclosure rule has been enforced against printer makers by name. In August 2018, after Creality shipped its CR-10 line with the GPLv3 firmware Marlin and did not release the corresponding source, US distributor Printed Solid publicly stopped selling Creality machines over the violation. The fights continued with Cython-compiled binary modules shipped inside the GPLv3 Klipper environment on Creality's K1 and K2 printers, documented in the K2-series Klipper dispute. On May 18, 2026, the Software Freedom Conservancy published a response alleging that Bambu Lab violated AGPLv3 by combining Bambu Studio with a proprietary networking library, and announced a project to reverse-engineer that library and free the slicer. None of these has been settled in court; together they show the obligation is one the community audits and enforces, not a dormant clause. A New York mandate that relies on a hidden filter inside this software relies on the one thing these licenses exist to prevent.

The split-file defeat and the wrong chokepoint

The defeats above share a method. A restricted geometry is a set of voids and features assembled into one shape, and constructive solid geometry lets a builder take it apart. An AR-15 lower can be divided into the magazine well, the fire-control pocket, and the buffer-and-grip mount, each saved as its own file. Printed on separate days and then bolted or solvent-welded together, each file on its own is a plain box or block that no per-file scan recognizes as part of a firearm. To catch this, a scanner would have to track a user's whole print history and predict how separate shapes assemble in the physical world, which the per-file check the statute describes does not do.

Behind the geometric problem sits a simpler one, developed in the companion essay: the part the printer makes is the part that bears the least stress. The frame or receiver is what federal law regulates, and it is also the only part a consumer printer can make, because fused-deposition plastic cannot contain the pressure of a fired cartridge. The barrel, slide, and bolt that hold that pressure are unregulated components bought without a background check. A 2024 study in Forensic Science International: Synergy catalogued 186 law-enforcement encounters with 3D-printed firearms and recorded only 14 involving fully printed guns. A scanner that perfectly blocked every fully printed frame would leave the hybrid build, the kind that turns up in casework, untouched, because its pressure-bearing parts never pass through the printer.

What you can do right now to keep this mandate from taking effect

Bottom line: the whole mandate hinges on one factual question the statute hands to a working group, whether geometry scanning can be made to work. One infeasibility finding under Executive Law § 837-aa(2) stops the rulemaking, and the printer sales requirement never takes effect. The most effective thing you can do is put solid technical evidence that the scanning cannot work in front of that working group.

The New York 3D printer blocking technology mandate is enacted but not yet in force. Governor Kathy Hochul signed the FY2026-2027 budget legislation carrying it on May 27, 2026. The printer sales requirement (General Business Law § 396-eeee) is dormant: it "shall take effect one year after the promulgation of rules as provided for in subdivision 3 of section 837-aa of the executive law ..." and no such rules exist as of June 2026. The bill already passed, so the goal is not to vote it down. It is to keep the mandate from ever taking effect, through the feasibility off-ramp the statute itself created.

The actions below are ordered by expected effect, most effective first. Start at the top.

#	Do this	How to start	Who receives it	Why it can make the law fail
1	Put technical evidence of infeasibility in front of the working group. Document the geometric false-positive problem, the open-source and offline-firmware compliance gap, and the hybrid-build point. You can send written evidence now: mail a one-page summary to the Division of Criminal Justice Services. The group has not convened yet; § 837-aa gives it ninety days from the May 27, 2026 enactment, until roughly late August 2026, and no meeting is scheduled. Watch the DCJS Open Meetings page for the notice and agenda.	That page lists each meeting's date, in-person address, and live webcast link, and DCJS posts the agenda at least 24 hours ahead. The Committee on Open Government states the public's right to attend meetings of public bodies. Mail written evidence to DCJS, Alfred E. Smith State Office Building, 80 South Swan St., Albany, NY 12210.	The § 837-aa working group, through its three convening agencies: the Division of Criminal Justice Services, the Department of State, and the State University of New York.	One infeasibility finding under § 837-aa(2) stops the rulemaking. No rules issue, so the one-year § 396-eeee clock never starts.
2	Ask the agencies to seat qualified technologists on the group: open-source firmware maintainers, additive-manufacturing engineers, and university or makerspace engineering staff. Send the same request to the Division of Criminal Justice Services, the Department of State, and SUNY.	Write three sentences asking that qualified technologists be seated, then send the same note through all three contact pages.	DCJS, the Department of State, and SUNY.	§ 837-aa(2) requires members with expertise in additive manufacturing, AI and digital security, and consumer product safety. Who sits on the group shapes the feasibility finding.
3	Send one specific technical message through official channels, identifying yourself as a New York resident or business. Open the Governor's message form, the Department of State contact form, or the DCJS contact page.	Paste three sentences saying the scanning requirement is not technologically feasible, name your county or business, and send it.	The Office of the Governor; the Department of State, headed by Secretary of State Walter T. Mosley; and the Division of Criminal Justice Services.	These offices run and oversee the agencies implementing the law, and they take a specific technical point from an identified resident or business.
4	Back the organized opposition. EFF's one-click action tool for this campaign is no longer accepting submissions, so the contact step runs through the legislator lookups in row 5. Read and share EFF's analysis and the Techdirt write-up of Adafruit's technical critique.	Cite EFF's civil-liberties case and Torrone's false-positive analysis in your own message to the agencies and your legislators.	The public record, and your legislators through the row 5 lookups.	EFF calls the requirement "an unfeasible tech solution." Adafruit's Phillip Torrone framed detection as a classification problem with high false-positive and false-negative rates. Both build the record a cautious working group has to weigh.
5	Ask your legislators to amend or repeal § 837-aa or § 396-eeee. Find your senator with the Senate's Find My Senator tool and your Assembly member with the Assembly Member Search.	Enter your home address in each lookup to reach the right office, then email both a line asking them to repeal or amend § 837-aa.	A state senator and an Assembly member.	A statutory change removes the mandate outright, but this route needs new legislation rather than the off-ramp the statute already hands the working group.
6	Not open yet: watch for the SAPA public comment. No comment docket exists now; one opens only after the working group clears feasibility and DCJS publishes a notice of proposed rule making. The notice and its comment address will appear in the New York State Register when it does.	To catch the window the day it opens, click the Subscribe button on the State Register page; it emails [email protected] to add you to the alert list for each weekly issue.	DCJS, through the State Register rulemaking docket.	When it opens, SAPA § 202 sets a comment period of at least sixty days and requires the agency to publish an assessment of public comment addressing the significant alternatives raised.

Why this works: § 837-aa(2) provides that "if the working group determines that it is not technologically feasible ... no regulations shall be required to be promulgated pursuant to this section, until such time as the working group determines that it is technologically feasible." Because § 396-eeee takes effect only one year after rules are promulgated, an infeasibility report means the clock never starts.

See also

• New York 3D printer blocking technology mandate
• User:Louis/3D-printed firearms and the technical basis for printer mandates
• Right to Repair
• Digital rights management
• Digital Millennium Copyright Act